Merge pull request #1 from wangwangping/alert-autofix-86

Fix code scanning alert no. 86: Server-side request forgery

Author: wangwangping

src/main/java/org/joychou/controller/SSRF.java

@@ -1,4 +1,6 @@
 package org.joychou.controller;
+import java.util.Arrays;
+import java.util.List;
 
 import cn.hutool.http.HttpUtil;
 import org.joychou.security.SecurityUtil;

src/main/java/org/joychou/util/HttpUtils.java

@@ -32,6 +32,19 @@
  * @author JoyChou 2020-04-06
  */
 public class HttpUtils {
+    private static final List<String> ALLOWED_URLS = Arrays.asList(
+        "http://example.com",
+        "http://another-allowed-url.com"
+    );
+
+    private static boolean isValidUrl(String url) {
+        try {
+            URI uri = new URI(url);
+            return ALLOWED_URLS.contains(uri.getScheme() + "://" + uri.getHost());
+        } catch (URISyntaxException e) {
+            return false;
+        }
+    }
 
     private final static Logger logger = LoggerFactory.getLogger(HttpUtils.class);
 
@@ -203,6 +216,9 @@ public static void IOUtils(String url) {
 
 
     public static String HttpAsyncClients(String url) {
+        if (!isValidUrl(url)) {
+            return "Invalid URL";
+        }
         CloseableHttpAsyncClient httpclient = HttpAsyncClients.createDefault();
         try {
             httpclient.start();